Data Leak Prevention

Overview

SkyConnect has multiple features to prevent data leakages. This topic describes the following:

a. Mail policies to control mail flow which can be used for inbound, internal and outbound mail.

b. Data leak prevention for the Inbound mail flow.

c. Data leak prevention for Outbound mail.

Mail polices 

What are mail policies and how do they work?

Mail policies is an advance security feature of SkyConnect which allows you to control mail flow from and to users and groups on your domain.

For example, using mail policies you can allow only a certain set of users to communicate with users on Gmail. Similarly, another set can only communicate with users of your domain. Or you can control who can send out attachments of a certain type and who is allowed to receive attachments.

Types of policies

When defining mail policies, you have to define sender and recipient policies. Sender policies are applied when the user is sending mail and Recipient policies are applied when the user or group is receiving mail.

So if you want to stop all communications between a user john@yourdomain.com and a Gmail user jane@gmail.com, then you will have to define a sender and a recipient policy for john@yourdomain.com.

Similarly, if you have a distribution list called all@yourdomain.com which is to be used only for internal purposes and you want to block all external communications to this group id, you will have to define a sender and recipient policy for this id.

If a certain id can only receive mail such as info@yourdomain.com but cannot be used to send out mail, then a sender policy has to be defined for this user and no recipient policy.

Defining a policy

Sender and recipient policies are defined by a Default action and zero or more exceptions to the default action. The Default action can be either Allow or Block.

Exceptions have an associated action which is opposite to the default action. For example, if the Default action is Block, then the exceptions will define all the conditions under which the default action of Block is not applied and the mail flow is allowed. Similarly, if the Default action is Allow, then the exceptions will define all the conditions under which the mail flow is to be blocked.

The conditions for the exceptions are defined using the following parameters:

• Sender for recipient policies and Recipient for sender policies

• Mail size

• Attachment size

Note: After encoding in the MIME format, the size of mail body or attachment increases by 33%. The encoding is required to convert 8 bit data to 7 bit data (suitable for transmission over the network). Hence to block the a mail of size 1 MB or 1024 KB, add a policy for mail size 1024 * 1.33 ~ 1366 KB.  In some cases where the mail/attachments may not be encoded, the mail/attachment size limit will be 1.33 MB.

• Attachment count

• Subject text

• Body text

• Attachment type

For each user or group you want to control, define the sender and recipient policies in a table as follows

Sample Mail Policies

Allow users to receive mail but not to send

Restrict domain users to send and receive mail mail from yahoo.com and gmail.com

Disable all users from sending emails to a particular email id like md@domain.com

Allow only domain users to send emails to the group all@yourdomain.com

Allow only users in group mgmnt to send emails to the group all@yourdomain.com

Allow only user md@yourdomain.com to send emails to the group all@yourdomain.com

Block only users of the group tempstaff@yourdomain.com to send emails to the group all@yourdomain.com

Block users from sending attachments to Gmail

Block users from sending more than 5 attachments

Block users from sending more than 2 MB of attachments

Block users from sending more mail with Happy Diwali in subject

Block users from sending gifs attachments

Configure mail policies for your domain

Data leak prevention for the Inbound mail flow

In addition to the mail policies which can control inbound, internal and outbound mail flow, you can configure some additional data leak prevention rules for the Inbound mail flow.

Your domain can be configured to Intercept, Modify or Monitor the incoming mail flow.

The Intercept actions possible are: 

• Deliver now

• Delete message

• Quarantine 

• Change recipient

The Modify actions possible are:

• Clean cleanable malware, delete those that cannot be cleaned
• Stamp the body with a cautionary message.
• Tag the subject with keywords which alert the recipient that the mail is from an external sender
• Delete matching attachments

The way to Monitor such Inbound mail would be to:

• Send an email notification to a predefined email id
• Send a bcc of the inbound mail to a predefined email id.

These actions can be taken for mails which match one or more of these conditions

• all inbound mail 
• all inbound mail for a selected set of users on your domain
• mail from a selected set of senders to any user on your domain
• mail from a selected set of senders to a select set of recipients on your domain
• all mail with certain attachments

Configure the DLP rules for your domain